We are *not* guaranteed that anything past the terminating NUL
is mapped (let alone initialized with anything sane).
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
diff --git a/mm/memcontrol-v1.c b/mm/memcontrol-v1.c
index 2aeea4d8bf8e..417c96f2da28 100644
--- a/mm/memcontrol-v1.c
+++ b/mm/memcontrol-v1.c
@@ -1842,9 +1842,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of,
buf = endp + 1;
cfd = simple_strtoul(buf, &endp, 10);
- if ((*endp != ' ') && (*endp != '\0'))
+ if (*endp == '\0')
+ buf = endp;
+ else if (*endp == ' ')
+ buf = endp + 1;
+ else
return -EINVAL;
- buf = endp + 1;
event = kzalloc(sizeof(*event), GFP_KERNEL);
if (!event)
On Fri 26-07-24 06:43:57, Al Viro wrote: > We are *not* guaranteed that anything past the terminating NUL > is mapped (let alone initialized with anything sane). > Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") > Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Acked-by: Michal Hocko <mhocko@suse.com> > --- > diff --git a/mm/memcontrol-v1.c b/mm/memcontrol-v1.c > index 2aeea4d8bf8e..417c96f2da28 100644 > --- a/mm/memcontrol-v1.c > +++ b/mm/memcontrol-v1.c > @@ -1842,9 +1842,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, > buf = endp + 1; > > cfd = simple_strtoul(buf, &endp, 10); > - if ((*endp != ' ') && (*endp != '\0')) > + if (*endp == '\0') > + buf = endp; > + else if (*endp == ' ') > + buf = endp + 1; > + else > return -EINVAL; > - buf = endp + 1; > > event = kzalloc(sizeof(*event), GFP_KERNEL); > if (!event) -- Michal Hocko SUSE Labs
On Fri 26-07-24 09:06:59, Michal Hocko wrote: > On Fri 26-07-24 06:43:57, Al Viro wrote: > > We are *not* guaranteed that anything past the terminating NUL > > is mapped (let alone initialized with anything sane). > > > > Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") > > > Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> > > Acked-by: Michal Hocko <mhocko@suse.com> Btw. this should be Cc: stable > > > --- > > diff --git a/mm/memcontrol-v1.c b/mm/memcontrol-v1.c > > index 2aeea4d8bf8e..417c96f2da28 100644 > > --- a/mm/memcontrol-v1.c > > +++ b/mm/memcontrol-v1.c > > @@ -1842,9 +1842,12 @@ static ssize_t memcg_write_event_control(struct kernfs_open_file *of, > > buf = endp + 1; > > > > cfd = simple_strtoul(buf, &endp, 10); > > - if ((*endp != ' ') && (*endp != '\0')) > > + if (*endp == '\0') > > + buf = endp; > > + else if (*endp == ' ') > > + buf = endp + 1; > > + else > > return -EINVAL; > > - buf = endp + 1; > > > > event = kzalloc(sizeof(*event), GFP_KERNEL); > > if (!event) > > -- > Michal Hocko > SUSE Labs -- Michal Hocko SUSE Labs
On Fri, Jul 26, 2024 at 09:13:00AM +0200, Michal Hocko wrote: > On Fri 26-07-24 09:06:59, Michal Hocko wrote: > > On Fri 26-07-24 06:43:57, Al Viro wrote: > > > We are *not* guaranteed that anything past the terminating NUL > > > is mapped (let alone initialized with anything sane). > > > > > > > Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") > > > > > Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> > > > > Acked-by: Michal Hocko <mhocko@suse.com> > > Btw. this should be > Cc: stable Point, except that for -stable it needs to be applied to mm/memcontrol.c instead...
On Fri 26-07-24 08:48:04, Al Viro wrote: > On Fri, Jul 26, 2024 at 09:13:00AM +0200, Michal Hocko wrote: > > On Fri 26-07-24 09:06:59, Michal Hocko wrote: > > > On Fri 26-07-24 06:43:57, Al Viro wrote: > > > > We are *not* guaranteed that anything past the terminating NUL > > > > is mapped (let alone initialized with anything sane). > > > > > > > > > > Fixes: 0dea116876ee ("cgroup: implement eventfd-based generic API for notifications") > > > > > > > Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> > > > > > > Acked-by: Michal Hocko <mhocko@suse.com> > > > > Btw. this should be > > Cc: stable > > Point, except that for -stable it needs to be applied to mm/memcontrol.c > instead... Correct. And if anybody wants to backport to pre 3.14 then to kernel/cgroup.c -- Michal Hocko SUSE Labs
© 2016 - 2024 Red Hat, Inc.